Though actually iirc werfault uses NtCreateUserProcess() to clone processes when writing out crash dumps to this day